c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 07:24

Target

c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe
Size

160KB
MD5

648d1ec4764463232e1121a27f664bc0
SHA1

e3dff379117fdc02338b199d4b3d2e2308de4a98
SHA256

c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83
SHA512

f577276b8fe59cffd7fcd9e359463455b317275f09a556cc667fa64d5073b8f33538aaf4af6c6ad1ad79409a743611cef438be4d391b557d41e46e411de3469f
SSDEEP

1536:F5cLTk0ogLsC9L/WZo2eH+hohzgDICA8Z3VAl1xg:gH15mZM+hohU3VAl1x

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1088-55-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/1088-57-0x0000000000400000-0x0000000000474000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1960	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1088	c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1960	1088	c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe	28
PID 1088 wrote to memory of 1960	1088	c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe	28
PID 1088 wrote to memory of 1960	1088	c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe	28
PID 1088 wrote to memory of 1960	1088	c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe	28

C:\Users\Admin\AppData\Local\Temp\c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe
"C:\Users\Admin\AppData\Local\Temp\c94fbb62c0a40b79520413cbba60c8bd4edd3a2f6a8e231305a39f026c700f83.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1960

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
7951ac88286e2e54c88ce3fbe8980dbb

SHA1
32c191a69205b49b1505bfa2a75aa68343062457

SHA256
6bb6c1f03001e755947b3c7c6b67c5c6285188980ec4aba52421e4e05ddb6378

SHA512
36373fa99d266994ebfb50d16f1531371bd86221c89e70a6f3d579a4535a62bc4f65aa1ded376606bc141e0cc22fc5d2fb99e13a5941dd12d715eaa31c81c738

Download Submit
memory/1088-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1088-55-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1088-57-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download